Our most recent update is a maintenance release containing further important
security fixes. We’re in the final stages of preparing a bookings update, but
various security issues were reported over the past few days and we decided to
bundle them all up into a fast update.
Just recently we had a major security update where we self-identified over 30
security vulnerabilities. Despite the thoroughness of that review, this latest
round highlights three important points:
- Even the best review can overlook security issues. Events Manager is constantly
under security scrutiny, and yet some issues still surface long after the code
that introduced them was written. - AI isn’t excluded above either. We used multiple models in our scans, and issues
still got past both our own review and the automated scanning the wider
WordPress ecosystem runs over plugin releases. - No code is safe from security threats, constant re-review is necessary.
We take every measure to write and maintain safe code, we welcome and appreciate
the regular scrutiny, it makes us better and stronger. We thank the recent
contributors who responsibly disclosed these vulnerabilities via Wordfence and
WordPress.
If you haven’t updated yet, please do so now.
Upcoming Changes – Bookings
Aside from this, we’ve been hard at work on a major project. It deserves its own
post, so we’ll just give you a little teaser.
We’re reworking bookings, something we’ve been mulling over and working towards
through our foundational updates over the past two years.
Not for events, not for appointments, for everything.
Anything reserving a space in place and/or time.
Our goal has always been to create the most solid events framework, and that
also means a flexible bookings engine. We look forward to taking bookings in
general to the next level.
Stay tuned!
7.4.1 Changelog
- Fixed: events could revert to Draft on save reporting that timeranges cannot overlap, and in some cases the event’s timeslots were silently removed
- Fixed: events saved in the block editor failed validation asking for consent that cannot be given there
- Fixed: saving a booking in the admin area failed with “The link you followed has expired” on sites running a page cache plugin
- Fixed: adding unavailable dates to a saved recurring event did nothing
- Fixed: recurrences set to specific dates could not be published, reporting that the end date must be greater than the start date
- Fixed: individually edited occurrences of a repeating event had their name, content and other details overwritten from the parent
- Fixed: detaching an occurrence from a repeating event silently failed and left the event out of sync with its post, with affected events repaired on upgrade
- Fixed: detaching tickets did nothing on sites not using the default
wp_database prefix - Fixed: fatal error when booking meta was saved with an empty value
- Fixed: deleting multiple events at once reported the wrong result
- Fixed: waitlist re-checks and other listeners of
em_bookings_deletedreceived no event ids - Fixed: listeners of
em_event_delete_prenever fired, due to a trailing space in the hook name - Fixed: on multilingual sites, bookings could resolve to the wrong event, and deleting a master event could detach occurrences from their series
- Fixed: on multisite, deleting a site left the timeslot, recurrence and booking meta tables behind
- Fixed: columns added to the timeslots table in a later release were never applied to existing sites, and upgrades could remove database indexes added elsewhere
- Security: Fixed a privilege escalation vulnerability. Reported by Jakub Herman.
- Security: Fixed an SQLi vulnerability. Reported by Jakub Herman.
- Security: Fixed an SQLi vulnerability (CVE-2026-15023). Reported by Dmitrii Ignatyev (CleanTalk) via Wordfence.
- Security: Fixed an XSS vulnerability (CVE-2026-17089). Reported by Wordfence PRISM.
- Security: Fixed an information disclosure vulnerability (CVE-2026-10627). Reported by molten bit via Wordfence.